From ceef1393ade9705231b63339650de0080f9b444c Mon Sep 17 00:00:00 2001
From: Nathan Henrie <nate@n8henrie.com>
Date: Thu, 29 Oct 2026 10:40:43 -0600
Subject: [PATCH] healthchecks: remove manual secrets creation in
 `local_settings.py`

Upstream now handles secretFiles and due to django updates the module
fails to start if `EMAIL_HOST_PASSWORD` is defined (due to `MAILERS`
also being defined).

See also: https://healthchecks.io/docs/self_hosted_configuration/

Fixes https://github.com/NixOS/nixpkgs/issues/571104
---
 .../manual/release-notes/rl-2611.section.md   |  2 ++
 pkgs/by-name/he/healthchecks/package.nix      | 26 -------------------
 2 files changed, 2 insertions(+), 26 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index ec6146230c8c..fbc2e5129f6c 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -683,3 +683,5 @@ The above example can be migrated via the following structured code block:
   If your environment requires strict reverse path filtering, you must now explicitly configure it with `networking.firewall.checkReversePath = "strict";`.
 
 - `services.photoprism` installations that are upgrading to version `260919-28c46a116` or later are advised to [migrate their library](https://docs.photoprism.app/user-guide/ai/face-recognition/#upgrading-an-existing-library) to take advantage of the newer face detection and embedding models. This can be done by using the `photoprism-manage` script.
+
+- `healthchecks` now natively supports `*_FILE` options for all secrets, and the prior package experienced breakage related to its manual handling of these secret files, so the manual process was removed and users will need to configure out-of-store secrets through conventional means (e.g. sops, agenix, etc.)
diff --git a/pkgs/by-name/he/healthchecks/package.nix b/pkgs/by-name/he/healthchecks/package.nix
index 5aa9a463ca34..83d09e1adc4e 100644
--- a/pkgs/by-name/he/healthchecks/package.nix
+++ b/pkgs/by-name/he/healthchecks/package.nix
@@ -45,36 +45,10 @@ py.pkgs.buildPythonApplication rec {
     whitenoise
   ];
 
-  secrets = [
-    "DB_PASSWORD"
-    "DISCORD_CLIENT_SECRET"
-    "EMAIL_HOST_PASSWORD"
-    "LINENOTIFY_CLIENT_SECRET"
-    "MATRIX_ACCESS_TOKEN"
-    "PD_APP_ID"
-    "PUSHBULLET_CLIENT_SECRET"
-    "PUSHOVER_API_TOKEN"
-    "S3_SECRET_KEY"
-    "SECRET_KEY"
-    "SLACK_CLIENT_SECRET"
-    "TELEGRAM_TOKEN"
-    "TRELLO_APP_KEY"
-    "TWILIO_AUTH"
-  ];
-
   localSettings = writeText "local_settings.py" ''
     import os
 
     STATIC_ROOT = os.getenv("STATIC_ROOT")
-
-    ${lib.concatLines (
-      map (secret: ''
-        ${secret}_FILE = os.getenv("${secret}_FILE")
-        if ${secret}_FILE:
-            with open(${secret}_FILE, "r") as file:
-                ${secret} = file.readline()
-      '') secrets
-    )}
   '';
 
   installPhase = ''